Executive brief
A vulnerability in the http4k library's cookie storage component could allow sensitive information to leak between different websites. If an application uses the same cookie storage to communicate with multiple services, it may inadvertently send private login tokens or session data to the wrong destination. This could also result in secure cookies being sent over unencrypted connections, potentially exposing them to interception.
Technical details
The `BasicCookieStorage` implementation in http4k (now renamed `InsecureCookieStorage`) failed to enforce RFC 6265 scoping rules. Specifically, it did not validate cookie domain, path, or the `Secure` attribute when retrieving cookies for a request. An attacker could potentially receive cookies intended for a different domain if a client uses a single storage instance for multiple origins. Additionally, cookies marked as `Secure` could be transmitted over plain HTTP. The issue is resolved by the introduction of `DefaultCookieStorage`, which is RFC 6265 compliant and now serves as the default implementation.
Affected products
- http4k http4k-core < 6.48.0.0, < 5.42.0.0, < 4.51.0.0
Timeline
- 2026-05-26: patched: Initial fix commit in repository
- 2026-06-16: disclosed: Advisory published by maintainers
- 2026-06-19: advisory: GitHub Advisory reviewed and published
References
- https://github.com/http4k/http4k/security/advisories/GHSA-pr33-38xx-6r26
- https://github.com/http4k/http4k/commit/6a9b44d743
- https://datatracker.ietf.org/doc/html/rfc6265
- https://github.com/http4k/http4k/releases/tag/6.48.0.0
- https://api.github.com/repos/http4k/http4k/security-advisories/GHSA-pr33-38xx-6r26